§396 Notification Requirements for Cyber Weapons

Summary

The Secretary of Defense must quickly send written notices to the congressional defense committees about cyber tools meant to be used as weapons. Every quarter, the Secretary must give the committees the combined results of all reviews done under DoD Directive 5000.01 that check whether those tools follow international law. If a military department actually uses a cyber tool as a weapon after it was approved, the Secretary must notify the committees within 48 hours of that use. The Secretary must also make and give the committees procedures for these notices that protect national security and operations, and must tell the committees in writing at least 14 days before changing those procedures. The committees must keep the information secure. If a covered cyber tool is leaked, the Secretary must notify the committees immediately, by phone or in writing, and must send a written notice within 48 hours if the first notice was verbal. These rules do not cover multinational training exercises with all nations’ consent or covert actions. Nothing here changes the War Powers Resolution, the Authorization for Use of Military Force, or the National Security Act.